## policy-files

### generate-cids

```bash
cargo run --bin newton-cli -- --chain-id 11155111 policy-files generate-cids \
    --directory policy-files \
    --output policy-files/policy_cids.json \
    --pinata-jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. .6F152S7v2OzVFLfeLCSBbS8G7iPQr-Mu9zt4gVoAXZw" \
    --pinata-gateway "blue-worried-penguin-373.mypinata.cloud" \
    --entrypoint "max_gas_price.allow"
```

Or args set via env vars

.env file

```bash
CHAIN_ID=11155111
PINATA_JWT="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. .6F152S7v2OzVFLfeLCSBbS8G7iPQr-Mu9zt4gVoAXZw"
PINATA_GATEWAY="blue-worried-penguin-373.mypinata.cloud"
```

```bash
cargo run --bin newton-cli -- policy-files generate-cids \
    --directory policy-files \
    --output policy-files/policy_cids.json \
    --entrypoint "max_gas_price.allow"
```

## policy-data

### deploy

```bash
cargo run --bin newton-cli -- --chain-id 11155111 policy-data deploy \
  --private-key "0xc0b6c0b1297061b371e91308db6a5c9b4f6d7f2d664ab8532f3f81e228da6ade" \
  --rpc-url "https://eth-sepolia.g.alchemy.com/v2/lnkxjj_rKFZRHqrrIvoerSJtzIdt2ElK" \
  --policy-cids policy-files/policy_cids.json
```

Or args set via env vars

.env file

```bash
CHAIN_ID=11155111
PRIVATE_KEY="0xc0b6c0b1297061b371e91308db6a5c9b4f6d7f2d664ab8532f3f81e228da6ade"
RPC_URL="https://eth-sepolia.g.alchemy.com/v2/lnkxjj_rKFZRHqrrIvoerSJtzIdt2ElK"
```

```bash
cargo run --bin newton-cli -- policy-data deploy \
  --policy-cids policy-files/policy_cids.json
```

### simulate

```bash
cargo run --bin newton-cli -- --chain-id 11155111 policy-data simulate \
  --wasm-file policy-files/policy.wasm \
  --input-json "{}"
```

## policy

### deploy

```bash
cargo run --bin newton-cli -- --chain-id 11155111 policy deploy \
  --private-key "0xc0b6c0b1297061b371e91308db6a5c9b4f6d7f2d664ab8532f3f81e228da6ade" \
  --rpc-url "https://eth-sepolia.g.alchemy.com/v2/lnkxjj_rKFZRHqrrIvoerSJtzIdt2ElK" \
  --policy-cids policy-files/policy_cids.json \
  --policy-data-address "0xdB9578b6c719122ECd30667D84D1fb483c789BC8"
```

Or args set via env vars

```bash
CHAIN_ID=11155111
PRIVATE_KEY="0xc0b6c0b1297061b371e91308db6a5c9b4f6d7f2d664ab8532f3f81e228da6ade"
RPC_URL="https://eth-sepolia.g.alchemy.com/v2/lnkxjj_rKFZRHqrrIvoerSJtzIdt2ElK"
```

```bash
cargo run --bin newton-cli -- policy deploy \
  --policy-cids policy-files/policy_cids.json \
  --policy-data-address "0xab23A45365F0BF660887B54b42787fA5519eb574"
```

### simulate

```bash
cargo run --bin newton-cli -- --chain-id 11155111 policy simulate \
  --wasm-file policy-files/policy.wasm \
  --rego-file policy-files/policy.rego \
  --intent-json policy-files/intent.json \
  --entrypoint "max_gas_price.allow" \
  --wasm-args policy-files/wasm_args.json \
  --policy-params-data policy-files/policy_params_data.json
```

Notes:

- The "data." prefix is automatically added to the entrypoint if not present. You can specify either "max_gas_price.allow" or "data.max_gas_price.allow".
- The `--wasm-args` argument is optional. If not provided, an empty JSON object `{}` will be used as input to the WASM execution.
- The `--policy-params-data` argument is optional. If not provided, an empty JSON object `{}` will be used for the params field in the policy evaluation.

## policy-client

### set-policy-params

```bash
cargo run --bin newton-cli -- --chain-id 11155111 policy-client set-policy-params \
  --policy-client "0x..." \
  --policy-params policy-files/policy_params_data.json \
  --expire-after 1000 \
  --private-key "0xc0b6c0b1297061b371e91308db6a5c9b4f6d7f2d664ab8532f3f81e228da6ade" \
  --rpc-url "https://eth-sepolia.g.alchemy.com/v2/lnkxjj_rKFZRHqrrIvoerSJtzIdt2ElK"
```

Or args set via env vars

.env file

```bash
CHAIN_ID=11155111
PRIVATE_KEY="0xc0b6c0b1297061b371e91308db6a5c9b4f6d7f2d664ab8532f3f81e228da6ade"
RPC_URL="https://eth-sepolia.g.alchemy.com/v2/lnkxjj_rKFZRHqrrIvoerSJtzIdt2ElK"
```

```bash
cargo run --bin newton-cli -- policy-client set-policy-params \
  --policy-client "0x058b50701c3Bb70B0F7cb4D583f005212679c903" \
  --policy-params policy-files/policy_params_data.json \
  --expire-after 1000
```

## task

### submit-evaluation-request

```bash
cargo run --bin newton-cli -- --chain-id 11155111 task submit-evaluation-request \
  --task-json path/to/task.json \
  --private-key "0xc0b6c0b1297061b371e91308db6a5c9b4f6d7f2d664ab8532f3f81e228da6ade"
```

Or args set via env vars

.env file

```bash
CHAIN_ID=11155111
PRIVATE_KEY="0xc0b6c0b1297061b371e91308db6a5c9b4f6d7f2d664ab8532f3f81e228da6ade"
DEPLOYMENT_ENV=stagef # .env only, not exposed as a cli parameter
```

```bash
cargo run --bin newton-cli -- task submit-evaluation-request \
  --task-json task.json
```

Notes:

- The `DEPLOYMENT_ENV` environment variable defaults to "prod" if not set. Valid values are "stagef" or "prod".
- The command normalizes the intent (converts value/chainId to hex), signs the task, and submits it to the prover AVS.
- The task JSON file should contain fields: `policyClient`, `intent`, `quorumNumber` (optional), `quorumThresholdPercentage` (optional), `wasmArgs` (optional), and `timeout`.

## newton-dashboard

### login

Login to Newton Dashboard and store the bearer token for future use.

```bash
cargo run --bin newton-cli -- --chain-id 11155111 newton-dashboard login \
    --dashboard-url "http://localhost:3000" \
    --api-base-url "http://localhost:8000" \
    --poll-interval 3 \
    --max-poll-time 300
```

Notes:

- The command opens your browser to the dashboard login page with a unique session ID.
- After logging in with email + OTP in the browser, the CLI polls the backend API endpoint `/v1/authn/cli-token/{session_id}` for the bearer token.
- The bearer token is automatically saved to `~/.newton/newton-cli.toml` and will be used for subsequent commands.
- The `--poll-interval` flag specifies how often to check for the token (default: 3 seconds).
- The `--max-poll-time` flag specifies the maximum time to wait for login (default: 300 seconds).
- Once logged in, you can run `upload-policy-and-secret` without providing `--bearer-token`.

### upload-policy-and-secret

Upload an encrypted policy secret to Newton Dashboard. After running `login`, the bearer token is automatically loaded from `~/.newton/newton-cli.toml`.

```bash
# With explicit bearer token
cargo run --bin newton-cli -- --chain-id 11155111 newton-dashboard upload-policy-and-secret \
    --api-base-url "https://dashboard.api.newt.foundation" \
    --policy-name "my-policy" \
    --policy-address "0x1234567890abcdef1234567890abcdef12345678" \
    --policy-data-address "0xabcdef1234567890abcdef1234567890abcdef12" \
    --secret-key "API_KEY" \
    --secret-value "my-secret-value" \
    --bearer-token "your-bearer-token"
```

```bash
# After running `newton-dashboard login`, bearer token is loaded automatically
cargo run --bin newton-cli -- --chain-id 11155111 newton-dashboard upload-policy-and-secret \
    --policy-name "my-policy" \
    --policy-address "0x1234567890abcdef1234567890abcdef12345678" \
    --policy-data-address "0xabcdef1234567890abcdef1234567890abcdef12" \
    --secret-key "API_KEY" \
    --secret-value "my-secret-value"
```

Or args set via env vars

.env file

```bash
CHAIN_ID=11155111
BEARER_TOKEN="your-bearer-token"
```

```bash
cargo run --bin newton-cli -- newton-dashboard upload-policy-and-secret \
    --api-base-url "https://dashboard.api.newt.foundation" \
    --policy-name "my-policy" \
    --policy-address "0x1234567890abcdef1234567890abcdef12345678" \
    --policy-data-address "0xabcdef1234567890abcdef1234567890abcdef12" \
    --secret-key "API_KEY" \
    --secret-value "my-secret-value"
```

Notes:

- The secret value is encrypted using RSA-OAEP with SHA-256 before being uploaded to the Newton Dashboard.
- The public key used for encryption is hardcoded in the KMS_PUBLIC_KEY_PEM constant in the newton_dashboard module.
- Use `--skip-tls-verify` flag if connecting to localhost with self-signed certificates.
- The `--bearer-token` flag is optional if you've already run `newton-dashboard login`.
- The `--api-base-url` flag is optional if stored in config from `newton-dashboard login`.
